WordPress Plugin Vulnerabilities

WP SMS < 6.2.0 - User Unsubscribe via CSRF

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Affects Plugins

Plugin icon
wp-sms
Fixed in 6.2.0

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
fc2d7281-abec-475b-8e8d-8dbc47de78da

Timeline

Publicly Published
2023-07-07 (about 2 years ago)
Added
2023-08-30 (about 2 years ago)
Last Updated
2023-08-30 (about 2 years ago)

Other

Published
Title
Published
2022-08-02
Title
uContext for Amazon <= 3.9.1 - Stored Cross-Site Scripting via CSRF
Published
2025-04-09
Title
ePaper Lister for Yumpu <= 1.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-01-16
Title
RSV GMaps <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2019-04-01
Title
Ultimate Member < 2.0.40 - Cross-Site Request Forgery (CSRF)
Published
2022-05-30
Title
Amazon Einzeltitellinks <= 1.3.3 - Arbitrary Settings Update to Stored XSS via CSRF